From 7a2d59de8e86844e61573a0dbef9f6a183e4608b Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Wed, 5 Sep 2018 15:38:53 +0300 Subject: [PATCH] Add OpenFaaS Istio mTLS and policies --- deploy/auto-scaling/podinfo-dep.yaml | 82 ++++++------------- .../auto-scaling/podinfo-svc-clusterip.yaml | 5 +- deploy/istio-system/openfaas-mtls.yaml | 51 ++++++++++++ deploy/istio-system/openfaas-ns.yaml | 13 +++ deploy/istio-system/openfaas-policies.yaml | 55 +++++++++++++ .../openfaas-virtual-service.yaml | 17 ++++ 6 files changed, 163 insertions(+), 60 deletions(-) create mode 100644 deploy/istio-system/openfaas-mtls.yaml create mode 100644 deploy/istio-system/openfaas-ns.yaml create mode 100644 deploy/istio-system/openfaas-policies.yaml create mode 100644 deploy/istio-system/openfaas-virtual-service.yaml diff --git a/deploy/auto-scaling/podinfo-dep.yaml b/deploy/auto-scaling/podinfo-dep.yaml index ebdc19f..69508f4 100644 --- a/deploy/auto-scaling/podinfo-dep.yaml +++ b/deploy/auto-scaling/podinfo-dep.yaml @@ -9,75 +9,41 @@ spec: metadata: labels: app: podinfo + #role: openfaas-system annotations: prometheus.io/scrape: 'true' spec: containers: - name: podinfod - image: stefanprodan/podinfo:0.0.9 - imagePullPolicy: Always + image: quay.io/stefanprodan/podinfo:1.0.1 command: - ./podinfo - - -port=9898 - - -logtostderr=true - - -v=2 - volumeMounts: - - name: metadata - mountPath: /etc/podinfod/metadata - readOnly: true - - name: resources - mountPath: /etc/podinfod/resources - readOnly: true + - --port=9898 + - --level=debug ports: - - containerPort: 9898 + - name: http + containerPort: 9898 protocol: TCP - readinessProbe: - httpGet: - path: /readyz - port: 9898 - initialDelaySeconds: 1 - periodSeconds: 2 - failureThreshold: 1 livenessProbe: - httpGet: - path: /healthz - port: 9898 - initialDelaySeconds: 1 - periodSeconds: 3 - failureThreshold: 2 + exec: + command: + - /bin/sh + - -c + - wget --quiet --tries=1 --spider http://localhost:9898/healthz || exit 1 + readinessProbe: + exec: + command: + - /bin/sh + - -c + - wget --quiet --tries=1 --spider http://localhost:9898/readyz || exit 1 resources: requests: memory: "32Mi" cpu: "10m" - limits: - memory: "256Mi" - cpu: "100m" - volumes: - - name: metadata - downwardAPI: - items: - - path: "labels" - fieldRef: - fieldPath: metadata.labels - - path: "annotations" - fieldRef: - fieldPath: metadata.annotations - - name: resources - downwardAPI: - items: - - path: "cpu_limit" - resourceFieldRef: - containerName: podinfod - resource: limits.cpu - - path: "cpu_request" - resourceFieldRef: - containerName: podinfod - resource: requests.cpu - - path: "mem_limit" - resourceFieldRef: - containerName: podinfod - resource: limits.memory - - path: "mem_request" - resourceFieldRef: - containerName: podinfod - resource: requests.memory + env: + - name: color + value: "blue" + - name: message + value: "Greetings from podinfo blue" + - name: backendURL + value: "http://podinfo-backend:9898/backend" diff --git a/deploy/auto-scaling/podinfo-svc-clusterip.yaml b/deploy/auto-scaling/podinfo-svc-clusterip.yaml index a16c39c..08df04b 100644 --- a/deploy/auto-scaling/podinfo-svc-clusterip.yaml +++ b/deploy/auto-scaling/podinfo-svc-clusterip.yaml @@ -2,13 +2,14 @@ apiVersion: v1 kind: Service metadata: - name: podinfo-clusterip + name: podinfo labels: app: podinfo spec: type: ClusterIP ports: - - port: 9898 + - name: http + port: 9898 targetPort: 9898 protocol: TCP selector: diff --git a/deploy/istio-system/openfaas-mtls.yaml b/deploy/istio-system/openfaas-mtls.yaml new file mode 100644 index 0000000..76a5dd2 --- /dev/null +++ b/deploy/istio-system/openfaas-mtls.yaml @@ -0,0 +1,51 @@ +apiVersion: authentication.istio.io/v1alpha1 +kind: Policy +metadata: + name: default + namespace: openfaas +spec: + peers: + - mtls: {} +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: default + namespace: openfaas +spec: + host: "*.openfaas.svc.cluster.local" + trafficPolicy: + tls: + mode: ISTIO_MUTUAL +--- +apiVersion: authentication.istio.io/v1alpha1 +kind: Policy +metadata: + name: default + namespace: openfaas-fn +spec: + peers: + - mtls: {} +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: default + namespace: openfaas-fn +spec: + host: "*.openfaas-fn.svc.cluster.local" + trafficPolicy: + tls: + mode: ISTIO_MUTUAL +--- +apiVersion: authentication.istio.io/v1alpha1 +kind: Policy +metadata: + name: openfaas-permissive + namespace: openfaas +spec: + targets: + - name: gateway + peers: + - mtls: + mode: PERMISSIVE diff --git a/deploy/istio-system/openfaas-ns.yaml b/deploy/istio-system/openfaas-ns.yaml new file mode 100644 index 0000000..f3e3b94 --- /dev/null +++ b/deploy/istio-system/openfaas-ns.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + istio-injection: enabled + name: openfaas +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + istio-injection: enabled + name: openfaas-fn diff --git a/deploy/istio-system/openfaas-policies.yaml b/deploy/istio-system/openfaas-policies.yaml new file mode 100644 index 0000000..5829ae4 --- /dev/null +++ b/deploy/istio-system/openfaas-policies.yaml @@ -0,0 +1,55 @@ +apiVersion: config.istio.io/v1alpha2 +kind: denier +metadata: + name: denyhandler + namespace: openfaas +spec: + status: + code: 7 + message: Not allowed +--- +apiVersion: config.istio.io/v1alpha2 +kind: checknothing +metadata: + name: denyrequest + namespace: openfaas +spec: +--- +apiVersion: config.istio.io/v1alpha2 +kind: rule +metadata: + name: denyopenfaasfn + namespace: openfaas +spec: + match: destination.namespace == "openfaas" && source.namespace == "openfaas-fn" && source.labels["role"] != "openfaas-system" + actions: + - handler: denyhandler.denier + instances: [ denyrequest.checknothing ] +--- +apiVersion: config.istio.io/v1alpha2 +kind: denier +metadata: + name: denyhandler + namespace: openfaas-fn +spec: + status: + code: 7 + message: Not allowed +--- +apiVersion: config.istio.io/v1alpha2 +kind: checknothing +metadata: + name: denyrequest + namespace: openfaas-fn +spec: +--- +apiVersion: config.istio.io/v1alpha2 +kind: rule +metadata: + name: denyopenfaasfn + namespace: openfaas-fn +spec: + match: destination.namespace == "openfaas-fn" && source.namespace != "openfaas" && source.labels["role"] != "openfaas-system" + actions: + - handler: denyhandler.denier + instances: [ denyrequest.checknothing ] diff --git a/deploy/istio-system/openfaas-virtual-service.yaml b/deploy/istio-system/openfaas-virtual-service.yaml new file mode 100644 index 0000000..5541f05 --- /dev/null +++ b/deploy/istio-system/openfaas-virtual-service.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: gateway + namespace: openfaas +spec: + hosts: + - "openfaas.istio.weavedx.com" + gateways: + - public-gateway.istio-system.svc.cluster.local + http: + - route: + - destination: + host: gateway + timeout: 30s +